Method for controlling a technical apparatus

A real-time computer system comprising a distributed real-time computer system for controlling a technical apparatus, wherein the real-time computer system comprises subsystems comprising a plurality of subsystems, wherein the subsystems are arranged hierarchically, wherein the subsystems are synchronized via a global time by using a time server (210), which is positioned outside the hierarchy of the subsystems, wherein the time server (210) is set up to periodically send synchronization messages (211) to each subsystem to the clocks of each subsystem for synchronizing the subsystems or the clocks of the subsystems for establishing the global time, and wherein, using this global time, the timeline is divided into a sequence of synchronized time slices, the real-time computer system comprising:

• each subsystem (100, 110, 120, 130) and, if present, the time server (210), forms its own Fault-Containment Unit, and wherein
• one of the subsystems is a decision subsystem, the so-called Fault-Tolerant Decision Subsystem, FTDSS, (100), which is preferably positioned at the highest level of the hierarchy, wherein the FTDSS (100) is set up to transfer setpoints to actuators (150) during each time slice by means of messages (101), wherein the Fault-Tolerant Decision Subsystem, FTDSS, (100) is a secure subsystem, i.e., contains simple software executed on fault-tolerant hardware, and wherein
• at least or exactly three Data Processing Subsystems, a Normal Processing Subsystem, NPSS, (110), a Monitor Subsystem, MSS, (120), and a Critical Event Handling Subsystem, CEHSS, (130), are provided, all of which are preferably positioned at the next lower hierarchical level, wherein these at least or exactly three Data Processing Subsystems are set up to capture sensor data by means of sensors (160) from an environment observed by the sensors (160) and to evaluate these sensor data independently of each other, wherein
• the environment is observed by the Data Processing Subsystems (110, 120, 130) at the beginning of each time slice and calculations are carried out during this time slice with the sensor data obtained from the observations of the environment carried out at the beginning of said time slice,
• the Normal Processing Subsystem, NPSS, (110) is set up to send a set of setpoints for normal operation to the Fault-Tolerant Decision Subsystem, FTDSS, (100) in a message (111) and to the Monitor Subsystem, MSS, (120) in a message (112) during each time slice, preferably at the end of the time slice, and wherein
• the Critical Event Handling Subsystem, CEHSS, (130) is set up to send a set of setpoints for abnormal operation to the Fault-Tolerant Decision Subsystem, FTDSS, (100) in a message (131) during each time slice, preferably at the end of the time slice, and wherein
• the Fault-Tolerant Decision Subsystem, FTDSS, (100) is set up to send the two received sets of setpoints for normal operation and abnormal operation to the Monitor Subsystem, MSS, (120) in a message (102) during each time slice, and wherein
• the Monitor Subsystem, MSS, (120) is set up to carry out a review during each time slice whether the set of setpoints for normal operation, which it received from the Normal Processing Subsystem, NPSS, (110) in the message (112), is compatible with an environmental model calculated by the MSS (120) on the basis of the sensor data (160) from the MSS (120) and ensures safe control of the technical apparatus under normal conditions, and furthermore the Monitor Subsystem, MSS, (120) is set up to carry out a review during each time slice whether the set of setpoints for normal operation, which it received from the Normal Processing Subsystem, NPSS, (110) in said message (112), is identical to the corresponding set of setpoints sent by the Normal Processing Subsystem, NPSS, (110) to the Monitor Subsystem, MSS, (120) via the Fault-Tolerant Decision Subsystem, FTDSS, (100) and,
• if both reviews are positive, to set a correctness indicator, correctness indicator-1, to the value TRUE and, if one of the two checks is negative or both checks are negative, to set the correctness indicator-1 to the value FALSE and to send the correctness indicator-1 or the value of the correctness indicator-1 to the Fault-Tolerant Decision Subsystem, FTDSS, (100) in a message (121) during each time slice, and wherein
• the Fault-Tolerant Decision Subsystem, FTDSS, (100) makes a decision as follows during each time slice:
• in the event that the correctness indicator-1 has a value of TRUE, the set of setpoints for normal operation is transferred to the actuators (150), for example in messages (101);
• in the event that the correctness indicator-1 has a value of FALSE or if a message (121) with the correctness indicator-1 expected by the FTDSS (100) is missing, the set of setpoints for abnormal operation is forwarded to the actuators (150), for example in messages (101), wherein, in this case, the setpoints for abnormal operation are forwarded to the actuators (150) during the time slices following that point in time until the technical apparatus reaches a safe state.